input {
  beats {
    port => 5044
  }
  udp {
    port => 10514
    type => "syslog"
  }
  lumberjack {
	port => 5043
	ssl_key => "/ssl/selfsigned.key"
	ssl_certificate => "/ssl/selfsigned.crt"
  }
}

filter {
  if [type] == "syslog" {
    mutate {
	  gsub => [ "message", "\t", "\\t" ]
    }
	if ![programname] {
	  json {
	  	source => "message"
	  }
	}
	mutate {
      replace => [ "type", "%{programname}" ]
    }
  }
}

output {
  kafka {
    codec => json
    bootstrap_servers => "kafka:9092"
	topic_id => "%{type}"
  }
  stdout {
	codec => rubydebug
  }
}